CONTENTS TRANSMISSION/RECEPTION SCHEME WITH 
FUNCTION FOR LIMITING RECIPIENTS 

5 BACKGROUND OF THE INVENTION 
FIELD OF THE INVENTION 

The present: invention relates to a contents 
transmission/reception system* a contents transmission 
10 device, a contents reception device, and a contents 
transmission/reception method for 

transmittingr/recelvlnff contents from a transmission 
device to a reception device. 

15 DESCRIPTION OF THE RELATED ART 

In conjunction with the spread and dlaritalization 
of computer networks in recent years, the products 
called dlsrltal information home electronics are 
becoming popular. Also, in conjunction with the start 

20 of the ground based digital broadcasting, it is 

expected that the digital broadcasting compatible TV, 
set-top box, DVD recorder, etc. will become more 
popular in the future. It is convenient for the users 
to connect these digital home electronics through 

25 networks . 

The di^rital contents have an advantage that they 
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can be easily copied wimout causlnsr any The 
deffradatioA In rhelr quality, but they also require 
measures concerning the copyright of the contents. 
Fie. 33 shows an overall confi^ratlon of a 
5 conventional network system having: a transmission 

device and a reception device. As shown in Fij^. 33, a 
transmission device i (referred hereafter as a source 
device B) is connected to a local area network 2 such 
as the Ethernet. The source device B 1, a reception 

10 device 4 (referred hereafter as a sink device A), and a 
router device C 5 are connected to an Erherner se^ent 
A 3 of this local area network 2, A sink device D 7 is 
connected to the router device C 5 through the Internet 
6. The sink device A 4 receives contents from the 

15 source device B 1 through the local area network 2. On 
the other hand, the sink device D T is located within a 
range in which communications with the source device B 
1 through the Internet 6 and the router device C 5 are 
possible. 

20 Here. the. contents indicate digital contents such 

as video data and audio data such as MPEG4 data and 
documents such as text data and image data, for 
example. Here, for the sake of explanation, the digital 
contents to be transferred after applying the copyright 

25 protection (which will be simply referred to as 
contents) will be considered. 
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Now, consider the case of transmitting contents 
from the source device B 1 to the sink device A 4 and 
the sink device D 7. At this point. It Is necessary to 
account for the copyright of the contents. As described 
5 above, a range for exchanging this contents should 
preferably be limited to a certain range, such as a 
range of a legitimate right such as a range of a 
personal use or a range narrower than that , for 
example, such that the contents cannot be exchange 

10 between others beyond that range. 

In order to realize the copyright protection, the 
following rules will be used regarding the contents 
transfer In the network system of Fig- 33. 

CI) The transmission/reception of contents that 

15 require the copyright protection is permitted within 

the local area network. This is because exchanges among 
devices connected to the local area network can be 
regarded as communications within a range of personal 
or family entertainment. 

20 {2} The transmission/reception of contents that 

require the copyright protection is not permitted 
outside the local area network. The communications 
outside the local area network indicate open 
communications through the public network such as the 

25 Internet or the telephone network, as In the 

communications between the source device B 1 and the 
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sink device D 7 shown in Fig. 33, for example. This is 
because the communi car Ions that are not closed within 
the local area network cannot be regarded as 
communications within a range of personal or family 
5 entertainment . 

Note that, in the following, the exemplary case of 
using The Ethernet as the local area network and using 
IP (Internet protocol) for tranfimission/reception of 
contents at an upper layer will be described. See 

10 documents disclosed at "http://www-ietf.org" for 

details regarding IP» for example. Of course, it is 
also possible to use the other protocols, as in the 
case where the local area network is the IEEE 1394 and 
the upper layer protocol is the IP over 1394 which 

15 emulates the IP, 

One method for limiting the contents distribution 
range to a range of personal entertainment is a method 
for permitting communications only within the identical 
local area network. In order to realize this, methods 

20 proposed conventionally include (IJ a method for 

carrying out AKE (Authentication and Key Exchange) by 
using Ethernet frames (Japanese Patent Application Laid 
Open No. 2O02<-X9}.35) , and (2) a metbod for checking 
whether the network address of the transmission device 

25 and the reception device are identical or not (Japanese 
Patent Application Laid Open No, 2001-285284) . Besides 



-4- 



These. There are also (3) a method for transmitting IP 
packets by setting ITL (Time To Live) equal to one, and 
(4) a combination ot the above described methods, 

A method combining the methods (2) and (3) will be 
5 described as an exemplary method tor Jiraitinff the 
transmission/reception of contents from the source 
device B 1 to sink devices within an identical Ethernet 
sesrment in an environment shown in Fig, 34. 

In general, in the IP, a pluraliTy of devices can 

10 be regarded as belonging to the identical Ethernet 

segment iT they have the same network address, so that 
it is possible to regard that the source device B 1 and 
the sink device are connected to the identical local 
area network by checking that they have the same 

15 network address. This method is shown in Fig. 3S, 

As shown in. Fig. 35, the network address A of the 
sink device is registered into the source device in 
advance (step 821). At a time of the 
transmission/reception of the contents, the source 

20 device compares the own nerwork address with the 

network address of the sink device (steps S22, S23) , 
and if rhey coincide, they are regarded as existing in 
The identical local area network (step S24) and the 
transmission of the contents is carried out. At this 

25 point, the TTL field of the packet destined to the sink 
device may be set equal to one (step S25) . If they do 
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not coincide, riie conrenrs transiaisslon/recep'Clon 
processing is Interrupted (step S26), Note that tlie 
comparison processing is carried out by the source 
device in this example, but the comparison processlnsr 
5 may be carried out by the sink device instead. 

However, it is possible to circumvent the above 
described limitation to the identical local area 
network based on the network address comparison, by 
making: appropriate settings in the source device and 

10 the sink device such that it appears as if the source 
device and the sink device are virtually existing in 
the identical sub-net even if the source device and the 
sink device are not physically connected to the 
identical local area network - 

15 One example of such cases is the VPN (Virtual 

Private Network) . which is a generic term tor 
indicating techniques for making^ a computer at a remote 
location to appear as If It Is connected to the local 
area network by constructing a network virtually, as a 

20 computer at a remote location which is connected to the 
Internet or an access point such as a router carries 
put communications with a computer connected to the 
local area network. 

The examples of the VPN Include L2TP, PPTP and 

25 IPSec. Here, the exemplary case of L2TP will be 

described. Note that the standardization of L2TP, PPTP 
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and IPSec Is in progress by the IETF, and details can 
be found in documents disclosed at 
"http : //www . letf , org" , 

Fig. 36 shows an exemplary network configuration 
5 using the VPN, As shown in Fig. 36, a source device B 
1, a sink device C 9, and a VPN server device D 60 are 
physically connected to an Ethernet segment A 3. and 
they have the Identical network address so as to 
constitute the local area network Z 61. Also, a sink 
10 device A 4 and a router device £ 5 have the identical 
network address so as to constitute the local area 
network Y. 

The VPN server device D 60 is provided with a 
router function and connected to the Internet 6, The 

15 sink device A 4 is assigned with a global IP address 
and connected to the VPN server device D 60 via the 
Internet 6 by using the VPN client function so as to 
constitute a virtual network X, such that the sink 
device A 4 is connected to this virtual network X. 

20 Here, what is Important is that the sink device A 4 is 
connected by the VPN so that the same network address 
as the source device B 1 and the sink device C 9 is 
assigned virtually to the sink device A 4. 

Now» at a time of transmitting contents from the 

25 source device B 1 to the sink device A 4. suppose that 
the above described distribution range limiting method 
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based on the network address comparison is applied. 
The sink device A 4 has the idenrlcal network 
address as the source device B 1 so that the network 
addresses will coincide. As long^ as the sink device A 4 
5 is connected to the Internet 6, reirardless of its 
location In the world, the source device B l can 
transmit the contents to the sink device A 4, 

Also, even If the source device B 1 transmits the 
IP packet by setting TTL = 1 to the sink device A 4, 
10 the value of the TTL can be easily chang-ed, so that the 
packet can reach the sink device A 4 if a device for 
chanerlng the value of the TTL is placed somewhere 
between the VPN server device D 60 and the source 
device HI, 

15 This implies that there can be cases where even If 

the sub-net addresses of the source device B 1 and the 
sink device A 4 are identical, these devices may not 
necessarily be existing physically in the identical 
local area network (the Ethernet segment In this 

20 example), 

BRIEF SUMMARY OF THE INVENTION 

25 It Is therefore an object of the present invention 

to provide a contents transmission/reception system, a 
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contents transmission device, a contents reception 
device, and a contents transmission/reception method 
capable ot transmitting contents only to limited 
reception devices. 
5 According to one aspect of the present Invention 

there is provided a contents transmission/reception 
system » comprlfilnff: a transmission device; and at least 
one reception device that receives contents from the 
transmission device; wherein the transmission device 

10 has: an authentication and key exchangee processing* unit 
configured to carry out an authentication and key 
exchange processing with a reception device that made a 
contents transmission request: a device identification 
information transmission request unit configured to 

15 transmit a device identification information request to 
the reception device, such that the reception device 
transmits a device identification information; a device 
identification information registration unit configured 
to register the device identification Information 

20 transmitted from the reception device; a device 

identification information search unit configured to 
search out the device identification information 
corresponding to an IP (Internet Protocol) address of 
the reception device, from a network to which the 

25 reception device is connected: a comparison Judgement 
unit configured to Judge whether the device 
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IdenxilTication Xn:formarion searched out by tJie device 
identification information search unit and the device 
identification information registered by the device 
identification information registration unit coincide 
5 or not; and a distribution condition determination unit 
configured to change a distribution condition for 
contents to be transmitted to the reception device that 
made the contents transmission request, according: to a 
Judgement result obtained by the comparison judgement 

10 unit; and the reception device has: a contents 
transmission request unit configured to make the 
contents transmission request to the transmission 
device; and a device identification information 
transmission unit configured to transmit the device 

15 identification information of the reception device to 
the transmission device, upon receiving the device 
identification Information request from the 
transmission device. 

According to another aspect of the present 

20 invention there is provided a contents transmission 
device for transmitting contents to at least one 
reception device, the contents transmission device 
comprising: an authentication and key exchange 
processing unit configured to carry out an 

25 authentication and key exchange processing with a 
reception device that made a contents transmission 
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request; a device Identification ln:forinatlon 
transzDissioa request unit conf iigrured to transmit a 
device Identification Inforniation request to the 
reception device, such that the reception device 
5 transmits a device Identification information; a device 
identification information registration unit confi^red 
to register the device identification information 
transmitted from the reception device; a device 
identification information search unit conflgrured to 

10 search out the device identification information 

corresponding to an IP (Internet Protocol) address of 
the reception device, from a network to which the 
reception device is connected: a comparison judgement 
unit configured to Judge whether the device 

15 identification Information searched out by the device 
identification Information search unit and the device 
identification information registered by the device 
Identification Information registration unit coincide 
or not: and a distribution condition determination unit 

20 configured to change a distribution condition for 

contents to be transmitted to the reception device that 
made the contents transmission request, according to a 
Judgement result obtained by the comparison Judgement 
unit, 

25 According to another aspect of the present 

invention there is provided a contents 
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transmission/reception sysrem, comprising: a 
transmission device; and ar least one reception device 
That receives conrents from the transmission device; 
wbereln a reception device has: a contents transmlssjj on 
5 request unit configrured to make a contents transmissjon 
request ro the transmission device: a first 
auThenrlcarion and key exchangre processing unit 
confieured to carry out an authentication and key 
exchan^^e processings with the transmission device to 

10 which the contents transmission request is made; a 

device identification information transmission request 
unit configured to transmit a device identification 
information request to the transmission device, such 
that the transmission device transmits a device 

15 identification information: a device identlf Icarion 
Information registration unit configured to register 
the device identification InforiDatlon transmitted from 
the transmission device: a device identification 
information search unit conflgrured to search out the 

20 device identification Information corresponding: to an 
IP (Internet Protocol) address of the transmission 
device, from a network to which the transmission device 
is connected: a comparison Judgement unit configured to 
Judg-e whether the device Identification information 

25 searched out by the device identification information 
search unit and the device identification information 



re^isrered by the device Identif icarion information 
registration unit coincide or not; and a reception 
condition determination unit configured to determine a 
reception condition for contents to be transmitted from 
the transmission device to which the contents 
transmission request is made, according to a judsemenr 
result obtained by the comparison judgement unit: and 
the transmission device has: a device identification 
information transmission imit configured to transmit 
the device identification Information of the 
transmission device to the reception device, upon 
receiving the device identification information request 
from the reception device; a second authentication and 
key exchange processing unit configured to carry out an 
authentication and key exchange processing with the 
reception device that made the contents transmission 
request; and a contents transmission control unit 
configured to carry out contents transmission control 
according to the reception condition determined by the 
reception condition determination unit. 

According to another aspect of the present 
invention there is provided a contents reception device 
for receiving contents from a transmission device, the 
contents reception device comprising: a contents 
transmission request unit configured to make a contents 
transmission request to the transmission device; an 
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authentication and key exchange processing unit 
confl^red to carry out an authentication and key 
exchangee processinir with the transmission device to 
which the contents transmission request Is made; a 
5 device Identification information transmission request 
unit configured to transmit a device identification 
information request to the transmission device, such 
that the transmission device transmits a device 
identification Information: a device identification 

10 information registration unit configured to register 
the device identification Information transmitted from 
the transmission device; a device Identlf Icarion 
information search unit configured to search out the 
device identification Information corresponding to an 

15 IP (Internet Protocol) address of the transmission 

device, from a network to which the transmission device 
is connected; a comparison Judgement unit configured to 
Judge whether the device identification information 
searched out by the device identification information 

20 search unit and the device identification informarion 
registered by the device identification Information 
registration unit coincide or not; and a reception 
condition determination unit configured to determine a 
reception condition for contents to be transmitted from 

25 the transmission device to which the contents 

transmission req.uest is made, according to a. Judgement 



-14- 



result obtained by rhe comparison judgemeni: unit. 

According to another aspect of the present 
invention there is provided a contents 
transmission/reception system, comprising: a 
5 transmission device: and at least one reception device 
that receives contents from the transraiselon device; 
wherein the transmission device has : a device 
identification information transmission request unit 
configured to transmit a device identification 

10 information request to a reception device that made a 
contents transmission request, such that the reception 
device transmits a device identification information; a 
device identification information registration unit 
confi^red to register the device identification 

15 information transmitted from the reception device; an 
advance notice unit configured to make a device 
Identification information search advance notice, to 
the reception device; a device identification 
information search unit configured to search out the 

20 device identification information corresponding to an 
IP (Internet Protocol) address of the reception device, 
from a network to which the reception device is 
connected; a comparison Judgement unit configured to 
judge whether the device identification information 

25 searched out by the device identification Information 
search unit and the device identification information 
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registered by the device identification information 
registration unit coincide or not; a request response 
reception Judgement unit conflerured to Jud^e whether a 
response to the device identification information 
5 search advance notice is received or not; and a 

distribution condition determination unit configrured to 
determine a distribution condition for contents to be 
transmitted to the reception device that made the 
contents transmission request, according to Judgement 

10 results obtained by the comparison Judgement unit and 
the request response reception judgement unit: and the 
reception device has; a device information transmission 
unit configured to transmit the device identification 
information of the reception device and a device 

15 identification Information search advance notice 

response to the transmission device, upon receiving the 
device Identification information request from the 
transmission device. 

According to another aspect of the present 

20 invention there is provided a contents transmission 
device for transmitting contents to at least one 
reception device, the contents transmission device 
comprising: a device identification Information 
transmission request unit configured to transmit a 

25 device Identification information request to a 

reception device that made a contents transmission 
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request, such that the reception device transmits a 
device identification information; a device 
identification information registration unit configured 
to register the device identification information 
5 transmitted from the reception device; an advance 

notice unit configured to make a device identification 
Information search advance notice, to the reception 
device; a device identification information search unit 
configured to search out the device Identification 

10 information corresponding to an IP (Internet Protocol) 
address of the reception device p from a network to 
which the reception device is connected; a comparison 
Judgement unit configured to Judge whether the device 
identification information searched out by the device 

15 identification information search unit and the device 
identification information registered by the device 
identification information registration unit coincide 
or not; a request response reception Judgement unit 
configured to Judge whether a response to the device 

20 identification information search advance notice is 
received or not: and a distribution condition 
determination unit configured to determine a 
distribution condition for contents to be transmitted 
to the reception device that made the contents 

25 transmission request, according to Judgement results 
obtained by the comparison Judgement unit and the 



requesT response reception judeeineni: unit:, 

Accordlner ro another aspect of ttie present 
Invention there is provided a contents 
transmission/reception system* comprisini:: a 
transmission device; and at least one reception device 
that receives contents from the transmission device; 
wherein the transmission device has: a device 
identification information search judgement unit 
confifiTured to Judsre whether a device identification 
information search request from a reception device is 
received or not; and a contents transmission control 
unit configured to prohibit transmission of contents to 
the reception device when the device identification 
Information search judgement unit Judc^es that the 
device identification information search request Is not 
received; and the reception device has: a contents 
transmission request unit configured to make a contents 
transmission request to the transmission device; an 
authentication and key exchange processing unit 
configured to carry out an authentication and key 
exchange processing with the transmission device to 
which the contents transmission request is made; a 
device Identification information transmission request 
unit conflgrured to transmit the device identification 
information request to the transmission device, such 
that the transmission device transmits a device 
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idenrlf Icatlon Information; a device identiTlcatlon 
information registration unit confisrured to register 
the device identification information transmitted from 
tlie reception device; an advance notice unit configured 
5 to make a device identification information search 
advance notice » to the transmission device; a device 
identification information search unit configxired to 
search out the device identification information 
corresponding to an IP {Internet Protocol) address of 

10 the transmission device, from a network to which the 
transmission device is connected: a comparison 
Judgement unit configured to Judge whether the device 
identification information searched out by the device 
identification information search unit and the device 

15 Identification information registered by the device 
identification information registration unit coincide 
or not; and a reception condition determination unit 
configured to determine a reception condition for 
contents to be transmitted from the transmission devjce 

20 to which the contents transmission request is made, 
according to a Judgement result obtained by the 
comparison Judgement unit. 

According to another aspect of the present 
invention there is provided a contents reception device 

25 for receiving contents from a transmission device, the 
contents reception device comprising: a contents 
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trrniBmlsslon request unit configured to make a contents 
transmission request to the transmission device; an 
authentication and key exchan§fe processing unit 
configxired to carry out an authentication and key 
exchanere processing with the transmission device to 
which the contents transmission request is made; a 
device identification Information transmission request 
unit conflgrured to transmit the device identification 
information request to the transmission device . such 
that the transmission device transmits a device 
identification information: a device identlf icat j on 
information registration unit configured to register 
the device identification information transmitted from 
the reception device: an advance notice unit configured 
to make a device identification information search 
advance notice, to the transmission device; a device 
Identification information search unit configured to 
search out the device identification information 
corresponding: to an IP (Internet Protocol) address of 
the transmission device, from a network to which the 
transmission device is connected: a comparison 
Judgement unit configured to Judge whether the device 
identification information searched out by the device 
Identification Information search unit and the device 
identification information registered by the device 
identification information registration unit coincide 
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or nor; and a receprlon condition deTerroinarlon unlT 
con^lgrured to determine a receprlon condition for 
conrenrs ro be transmitted from the transmission device 
to wnich rhe contents transmission request Is made* 
5 according: to a Judgement result obtained by the 
comparison Judgement unit. 

Other features and advantages of the present 
Invention will become apparent from the following 
description taken In conjunct j on with the accompanying 
10 drawings - 

BRIEF DESCRIPTION OF THE DRAWINGS 

15 Fig. 1 is a block diagram showing one schematic 

configuration of a contents transmission/reception 
system according to the first embodiment of the present 
Invention- 

Fig- 2 Is a block diagram showing an exemplary 
20 Internal configuration of a source device A in the 
contents transmission/reception system of Fig, 1. 

Fig. 3 is a diagram showing a structure of a MAC 
address table used in the source device A of Fig. 2. 
Fig. 4 is a block diagram showing an exemplary 
25 Internal configuration of a sink device B, C in the 
contents rransmission/reception system of Fig. 1. 
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Fie- 5 is a sequence chart show loe one processing 
procedure of rhe contents transmission/reception system 
of Flff. 1- 

Flg, 6 Is a sequence chart showing another 
processing procedure of the contents 
transmission/reception sysrem of Fie. l. 

Fiff- 7 is a flow chart showing a processing 
procedure of the source device A of Fig. 2, 

Fig. 8 is a block diagram showing another 
schematic configuration of a contents 
transmission/reception sysrem according to the first 
embodiment of the present invention in which a VPN 
server device is connected between a source device and 
a sink device. 

Fig, 9 is a block diagram showing one schematic 
configuration of a contents transmission/reception 
sysrem according to the second embodiment of the 
present invention. 

Fig- 10 is a block diagram showing another 
schematic configuration of a contents 
transmission/reception system according to the first 
embodiment of the present invention in which a VPN 
server device and a VPN client device are tunneling two 
networks. 

Fig- 11 is a block diagram showing one exemplary 
Internal configuration of a source device in the 
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contents transmission/reception sy&teiu of Fie. 9 or 
Flfif, XO. 

Fig:. 12 is a block diagram showiner one exemplary 
internal configuration of a sink device In tHe contents 
5 transmission/reception system of Fig. 9 or Fig. 10. 
Fig. 13 Is a block diagram showing another 
exemplary Internal configuration of a source device In 
the contents transmission/reception system of Fig. 9 or 
Fls- 10. 

10 Fig. 14 is a block diagram showing another 

exemplary internal conf igruration of a sink device in 
rhe contents transmission/reception system of Fig. 9 or 
Fig. 10, 

Fig- 15 is a diagram showing three types of VPN 
15 device connection state in the contents 

transmission/reception system of Fig. 9 or Fig. 10. 

Fig. 16 Is a block diagram showing one schematic 
configuration of a contents transmission/reception 
system according to the third embodiment of the present 
20 invention. 

Fig. 17 is a block diagram showing an exemplary 
Internal configuration of a source device A in the 
contents transmission/reception system of Fig. 16. 

Fig. 18 is a block diagram showing an exemplary 
25 internal configuration of a sink device B, C In the 
contents transmission/reception system of Fig. 16. 
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Fi&. 19 is a Bequence chart showing: one processing 
procedure of The contents rransmlsslon/receprion system 
of Fis- 16 in the case where a source device and a sink 
device are physically existing in an Identical segment. 
5 Fig, 20 is a sequence chart showing another 

processing procedure of the contents 

transmission/reception system of Fig. 16 in the case 

where a source device and a sink device are not 

physically existing in an identical segment. 
10 Fig. 21 is a block diagram showing an exemplary 

internal configuration of a source device in a contents 

transmission/reception system according to the fourth 

embodiment of the present Invention, 

Fig. 22 is a block diagram showing an exemplary 
15 internal configuration of a sink device in a contents 

transmission/reception system according to the fourth 

embodiment of the present invention. 

Fig. 23 is a seqaence chart showing one processing 

procedure of a contents transmission/reception system 
20 according to the fourth embodiment of the present 

invention in the case where a source device and a sink 

device are physically existing in an identical segment. 
Fig, 24 is a sequence chart showing another 

processing procedure of a contents 
25 transmission/reception system according to the fourth 

embodiment of the present invention in the case where a 
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source device and a sink device are not physically 
exlstlner In an Identical segment. 

Fler. 25 is a block diagrram showing an exemplary 
internal configuration of a source device in a contents 
5 transmission/reception system according to the fifth 
embodiment of the present invention. 

Fig. 26 is a block diagram showing an exemplary 
internal configuration of a sink device in a contents 
transmission/reception system according to the fifth 
10 embodiment of the present invention. 

Fig. 27 is a sequence chart showing one processing 
procedure of a contents transmission/reception system 
according to the fifth embodiment of the present 
Invention in the case where a source device and a sink 
15 device are physically existing in an identical segment. 

Fig. 28 is a sequence chart showing another 
processing procedure of a contents 

transmission/reception system according to the fifth 
embodiment of the present invention in the case where a 
20 source device and a sink device are not physically 
existing in an Identical segment. 

Fig. 29 is a block diagram showing an exemplary 
internal configuration of a source device in a contents 
Transmission/reception system according to the sixth 
25 embodiment of the present invention. 

Fig. 30 is a block diagram showing an exemplary 
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lELternal conf ig^uratton of a sink device In a contents 
transmission/reception system accordine: to the 6lxth 
embodiment of the present Invention, 

Flff- 31 is a sequence chart showing one processing^ 
procedure of a contents transmission/reception system 
according: to the sixth embodiment of the present 
invention in the case where a source device and a sink 
device are physically existing in an Identical segment. 

Fig. 32 is a sequence chart showing another 
processing procedure of a contents 

transmission/reception system according to the sixth 
embodiment of the present invention In the case where a 
source device and a sink device are not physically 
existing in an identical segment. 

Fig. 33 is a block diagram showing an overall 
configuration of a conventional network system having a 
transmission device and a reception device. 

Fig- 34 is a block diagram showing an overall 
configuration of a conventional network system in which 
different sink devices are connected to Ethernet 
segments A and B. 

Fig- 35 is a flow chart showing a processing 
procedure for Judging whether network addresses of a 
source device and a sink device are identical or not in 
the conventional network system of Fig. 34. 

Fig- 3B is a block diagram showing an exemplary 
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conf i^rurarion of a conventional network system usln? 
VPN. 

5 DETAILED DESCRIPTION OF THE INVENTION 

Referring now to Flgr, 1 to Fig, 32, embodiments of 
the contents transmission/reception system according to 
the present Invention will be described In detail. In 

10 the following, the Ethernet is used as an exeaplary 
physical network, and the IP is used as an exemplary 
upper layer protocol. Of course, it is also possible to 
use the other protocols, as In the case where the local 
area network is the IEEE 1394 and the upper layer 

15 protocol is the IP over 1394 which emulates the IP. 
(First Embodiment) 

Fiff/i X shows a schematic configuration of the 
contents transmission/reception system according to the 
first embodiment of the present invention. The contents 

20 transmission/reception system of Fig, 1 has a sink 

device B 11, a sink device C 12, a source device D 16 
and a router device F 13 which are connected to an 
Ethernet segment a lO, and a source device A 15 
connected to the router device F 13 through the 

25 Internet 14. The sink device B 11 has a VPN server 

function, and the source device A 15 has a VPN client 



-27- 



runction. 

The sink devices B 11 and C 12 are connected to 
the identical Ethernet seement A 10, and have the 
identical network address so as to constitute the local 

5 area network. 

Here, the method tor limiting the contents 
distribution rangre to a certain range (the Ethernet 
segnuent A 10 in this example) will be described. 
Namely, the transmission/ reception of contents from the 

10 source device D 16 Is permitted to the sink devices B 
11 and C 12 physically connected the Ethernet segment A 
10. but transmission/reception of contents from the 
source device A 15 which is connected to another 
Ethernet segment by using the VPN function is not 

15 permitted. 

In this embodiment, even if the sink device and 
the source device constitute a virtual network by using 
the VPN such that it appears as if they are connected 
to the identical local area network, the case where the 

20 device is physically connected to the Ethernet segment 
and the case where the device is virtually connected 
are distlngruished. 

Here, an exemplary case of usine DTCP (Digital 
Transmission Contents Protection) as a mechanism for 

25 device authentication and key exchange and contents 
encryption/decryption at a time of 
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transmltrixiff/receivlngr conteprs will be described. The 
DTCP Is a cntenr transmission copyright prorection 
scheme rhar is de facto standard In the IEEE 1394 and 
USB, and provided with a mechanism for carryinff out the 
5 authentication and key exchantgre between the 

transmission device and the reception device, and 
transferring AV data by encrypting the AV data that 
requires the copyright protection (see documents 
disclosed at "http : //www- dtcp - com" . for example). 

10 Fig- 2 shows an exemplary internal configuration 

of the source device A 15 or the source device D 16, As 
shown in Fig. 2. the source device A 15 or D 16 has a 
network Interface unit 21 for executing the physical 
layer processing of the Ethernet, a communication 

15 processing unit 22 for executing the datallnk layer 
processing/ a MAC address recording unit 24 for 
recording a MAC address of the network Interface of the 
sink device into a MAC address table z3, a sink device 
MAC address search processing unit 25 for searching the 

20 MAC address from the IP address of the sink device, a 
MAC address comparison processing unit 26 for checking 
whether the MAC address acquired by the sink device MAC 
address search processing unit 25 and the MAC address 
recorded In the MAC address recording unit 24 coincide 

25 or not. an authentication and key exchange processing 
unit 27 for carrying out the DTCP authentication and 



-29- 



key exchangee processlngr for tbe purpose of the 
copyrieht prorecrion, a DTCP encryption processing unlr 
28 for encryptlnff/decryptinff data to be 
transmitted/received, a packet processing unit 29 for 
5 converting the contents data to be transmitted to the 
sink device and the DTCP management data into IP 
packets, a VPN server unit 40 for making^ the VPN 
connection as a VPN server upon receiving a VPN 
connection request from a VPN client, and a contents 

10 providing unit 30 for providing the contents to the 
packet processing unit 29. 

Here, it is assumed that L2TP CLayer z Tunneling 
Protocol) is used as an exemplary VPN protocol. The 
L2TP is widely used for realizing the VPN, and the 

15 standardization of the L2TP is in progress by the IETF 
(see documents disclosed at ''httpr/Zwww.letf .org", for 
example. 

Note also that it is assumed that the source 
device A 15 and the source device D 16 have the . 
20 identical configuration, but it is not absolutely 
necessary to provide the VPN. server unit 40 in the 
source device D16. because the source device D 16, the 
sink device fi ll and the sink device C 12 are connected 
on the Identical Ethernet segment so that there is no 
2S need to make a connection by using the VPN. 

Note also that the comparison processing is a 
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processing for checking wherher xhe MAC address 
corresponding vo the IP address or the device ID of rhe 
sink device that is a contents transmission tarsrer is 
recorded in the MAC address table 23 or not, and 
5 checking whether the values of the MAC addresses 
coincide or not. 

Fie. 3 shows a structure of the MAC address table 
23. As shown in Fifir^ 3, the IP address, the MAC address 
and the DTCP device ID corresponding to each sink 
10 device are recorded in each record. The MAC address 

comparison processing unit 26 searches the MAC address 
by uslns the IP address or the device ID acquired from 
rhe sink device as a key, from this MAC address table . 
23. 

15 Fig, 4 shows an exemplary internal configuration 

of the sink device B 11 or C 12. As shown in Fig. 4, 
the sink device B 11 or C 12 has a network interface 
unit 31 for executing the physical layer processing of 
the Ethernet, a communication processing unit 32 for 

20 executing the datalink layer processing, a MAC address 
transmission unit 33 for acquiring the MAC address 
stored in the network interface unit 31 and 
transmitting it to the source device, a VPN client unit 
34 for making the connection to the VPN server via the 

25 Internet as a VPN client, a DTCP authentication and key 
exchange processing unit 35 for carrying out the DTCP 
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authentication and key exchange processing tor the 
purpose of the copyright protection, a DTCP encryption 
processing unit 36 tor encr3T>tin&/ decrypting the data 
to be transmitted/received, a packet processing unit 37 
5 for converting the IP packets received from the source 
device into the contents data or the DTCP management 
data, and a contents processing unit 38 for carrying 
out a processing for outputting the decrypted contents 
to a display device or storing the decrypted contents. 

10 Here, it is assumed that the sink device B 11 and 

the sink device C 12 have the identical configuration, 
but In the case where the source device D 16 and the 
sink device C 12 carry out communications, there Is no 
need for the VPN connection, so that it is not 

15 absolutely necessary to provide the VPN client unit 34 
in the sink device. 

Note also that, in the configurations described 
above , the source device A 15 has the VPN server unit 
40 and the sink device B li has the VPN client unit 34, 

20 but what is important is that the source device A 15 
and the sink device B II carry out communications by 
the VPN. so that it is also possible to use 
configurations in which the VPN functions are 
interchanged. i,e., configurations in which the source 

25 device A 15 has the VPN client unit 34 and the sink 
device B 11 has the VPN server device 40, 
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Fig, 5 and Fig, 6 show a processing procedure of 
the conuDunXcatlon system in this erobodlment, and Fig. 7 
shows a processing procedure of the source device A 15, 
In the following, the exemplary case of transmitting 
the contents from the source device D 16 to the sink 
device C 12 will be described first with references to 
Fig- 6 and Fig- 7. 

Firsts when a contents transmission request is 
made from the sink device C 12 to the source device D 
16 Cstep SI), the DTCP authentication and key exchange 
processing is carried out (step S2) . 

Note that when the contents transmission requesr 
is made, it is also possible to set the TTL field of 
the IP packets equal to one at a time of transmitting 
management data regarding the authentication and key 
exchange for the purpose of the copyright protection 
and the contents to the sink device C 12 (steps S2, 
sii) . In addition, as described in The background art 
section above, it is also possible to carry out the 
comparison processing regarding whether the network 
addresses of the sink device and the source device 
coincide or not. If the network addresses of the sink 
device C 12 and the source device D 16 are different, a 
prescribed error processing is carried out and the 
communication is interrupted. These processings may be 
carried out before, during, or after the auth ntication 



and key exchange processing. 

When the DTCP authenrication and key exchange 
processing succeeds (step S3), tjie source device D 16 
rransxnlTs a command for requesting a transmission o^ 
5 the MAC address to the sink device C 12 (step S4). This 
command can be an Independent command or a "MAC address 
request command" added to the grroup of commands defined 
by the DTCP. Upon receiving the MAC address request 
command, the sink device 0 12 transmits the MAC address 

10 to the source device D 16 through the MAC address 
transmission unit 33 (step 35). 

At this point, it is also possible to atrtrach a 
signature for proving that the MAC address is not 
altered on the communication route. This signature can 

15 be attached by the. well known method such as ISO/IEC 
14888, for example. 

When the MAC address of the sink device C 12 is 
acquired (step S13). the source device D 16 registers 
the MAC address into the MAC address table 23 (steps 

20 S6. S14), At this point, the MAC address and the IP 
address or the DTCP device ID of the sink device C 12 
may be recorded as a set. 

What is described above is a method for 
registering the MAC address of the sink device C 12 

25 into the MAC address table 23 by receiving the MAC 

address from the sink device C 12 via the network. Ii. 
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is also possible to realize this registration by many 
other methods. For example, it Is possible to use (1) a 
method for Inputting the MAC address of the sink device 
C 12 into the source device D 16 by the user in advance 
by using an Interface such as buttons, or (2 J a method 
for recording the MAC address Into the MAC address 
table 23 of the source device D 16 by using a card or 
the like that records the MAC address of the sink 
device C 12- 

Next. the source device D 16 transmits a packet 
for making an inquiry of the MAC address by using the 
IP address to the Ethernet segment A 10. This can be 
realized by the well known method such as the ARP 
(Address Resolution Protocol) defined by RFC 826, for 
example. If they are connected to the identical segment 
physically, the host having that IP address returns the 
MAC address assigned to the own device as a response 
(steps S8, S15) . For example, when the source device D 
16 transmitted a request of the ARP to the IP address 
"192. 168-1, 5" , the sink device C 12 with the IP address 
192. 168. 1.5- returns its own MAC address "CC:CC:CC" as 
a response to the source device D 16. 

Next, the source device D 16 carries out tne 
comparison processing for checking whether the MAC 
address of the sink device C 12 acquired as a result of 
the MAC address request command and the MAC address 
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acquired by tUe ARP coincide or not (steps S9 , 816). If 
two values coincide, the processing is continued (steps 
S17. SIB). 

At the step S7 described above. It is also 
possible to search the MAC address by using the device 
ID as a key, instead of using the IP address as a key. 
at a time of searching the MAC address of the 
correspondent sink device from the MAC address table 
23. 

In the comparison processing of the above 
described step S16, if the MAC addresses do not 
coincide t a prescribed error processing is carried out 
and the communication is interrupted (steps SIO, S19) . 
Also, when the MAC address of the sink device C 12 
cannot be acquired by the ARP, a prescribed error 
processing is carried out and the communication is 
interrupted. In this example, the value registered in 
the MAC address table in advance and the value acquired 
by the ARP are identical so that the contents 
transmission processing is carried out. 

Next, an exemplary case of transmitting the 
contents from the source device A 15 to the sink device 
B 11 is shown in Fig. S. The source device A 15 is 
connected to the sink device B li by the VPN, and in a 
state capable of carrying out communications. The 
processing by which the source device A 15 requests the 
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MAC address to rhe sink device B 11. acquires the MAC 
address of the sink device B 11 by the upper level 
protocol o± the IP. and records the MAC address (step 
S6) can be carried out similarly as in the ease of 
transmission from the source device D 16 to the sink 
device C 12. The source device A 15 transmits a packet 
for inquiring the MAC address by using the IP address 
of the sink device B li I the ARP packet, for example), 
to the Ethernet segment to which the source device A 15 
is connected. In this case, the sink device B 11 is not 
connected to that Ethernet segment, so that the sink 
device B 11 will never return its own MAC address 
"CCtCCiCC" as a response. For this reason, the source 
device A 15 will not acquire the MAC address of the 
sink device B 11 and the MAC address comparison 
processing will fall. As a result, the source device A 
IS carries out the error processing and the 
communication is terminated without transroiTTlng the 
contents to the sink device B 11. 

Note that at a time of the error processing when 
rhe MAC addresses do not coincide or at a time of 
disconnecting the connection with the sink device, the 
record regarding the sink device may be stored or may 
be deleted. For example, when the IP address of The 
sink device is assigned by the DHCP, the IP address at 
a time of the next access can be different so that it 
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Is preferable to delete the record so as to save the 
memory capacity of the table and simplify the 
configuration of the device. 

In the above, the exemplary case of carrying out 
5 the MAC address checklnff processine only when the 

authentication succeeds in the DTCP authenrication and 
key exchanere processins has been described. Besides 
that, there are other methods for checking the MAC 
address including (1) a method for transmitting the MAC 

10 address along' with the DTCP contents request command at 
a time of transroittin§r the contents request from the 
sink device to the source device, and (2) a merhod for 
carrying out the MAC address checking processing: prior 
to the DTCP authentication and key exchange processing. 

15 What is important here is that the sink device has 

a function for transmitting the MAC address to the 
source device by the method which is not the Ethernet, 
and it Is possible to Judge whether the sink device and 
the source device are physically connected to the 

20 Ethernet segment or not even if the sink device and the 
source device are on the identical sub-net, by 
comparing the MAC address with the MAC address acquired 
by the processing for searching the MAC address by 
using the IP address on the Ethernet. 

25 Even if the router device physically connected to 

the same Ethern t segrment as the source device A 15 
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forces the M/VC address and transmlrs the same MAC 
address as the MAC address of the sink device B 11 as a 
response to the MAC address requesr from the source 
device A 15, the source device A 15 would transmit the 
5 Ethernet packets to that forced MAC address, so that 
the sink device B 11 cannot receive these packets and 
the object of limiting the contents distribution ran^e 
can be achieved . 

Next* the contents transmission/reception in the 

10 case where a VPN server device is connected between the 
source device and the sink device as shown in Fic- 8 
will be described. The contents transmission/reception 
system of Fig. 8 has a source device B 51 ► the sink 
device C 52, a VPN server device F 53 and a router 

15 device D 54 which are connected to the identical 

Ethernet segitient A 50 * rad a sink device A 56 connected 
to the VPN server device F 53 through the Internet 55 
and a sink device £ 5S connected to an Ethernet segment 
B 57, 

20 The source device B 51, the sink device C 52, the 

VPN server device F 53 and the router device D 54 have 
the identical network address so as to constitute a 
local network- 

The sink device A S6 has a global IP address 

25 assigned and is in a state capable of making the 

connection to the VPN server device F 53 through the 
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Internet 55 by usine the VPN client function. 

In the contents transmission/reception system of 
Fig. 8. the case of transmitting the contents from the 
source device B 51 to the virtually connected sink 
device A 56 via the VPN server device F 53 will he 
considered how. 

First, the procedure by which the source device B 
51 receives the MAC address from the sink device A 56 
and registers it can be the same as the above described 
procedure. Then, the source device B 51 transmits a 
packet for inquiring the MAC address by using the IP 
address of the sink device A 56 to the Ethernet segment 
A 50, 

Since the sink device A 56 is not physically 
connected to the Ethernet segment A 50, the VPN server 
device F 53 returns its own MAC address as a proxy of 
the MAC address of the sink device A 56 as a response. 
The source device B 51 carries out the comparison 
processing for these two MAC addresses, but the MAC 
address of the sink device A 56 and the lYIAC address of 
the VPN server device F 53 are different so that the 
values do not coincide. For this reason/ the contents 
transmission processing will be interrupted. 

Next, the case of transmitting the contents from 
the source device B 51 to the sink device £ 58 will be 
considered. The source device B 51 requests the MAC 
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address to the sink device 58. and acquires rhe MAC 
address of the sink device E 5S by the upper level 
protocol of the IP, However p in this conf leuration. the 
Ethernet segment A 50 to which the source device B 51 
is cormected and the Ethernet segment B 57 to which the 
sink device E 58 is connected are different. 
Consequently, even if the source device B 51 transmits 
a packet for inquiring the MAC address by using the IP 
address of the sink device E 58. this packet will not 
be transferred to the sink device E 58 by the router 
device D 54, and the source device B 51 will not 
receive the MAC address from the sink device E 58. As a 
result, the MAC address comparison processing carried 
out hy the source device B 51 will fail and the 
contents transmission processing will be interrupted - 

By the processing described above, the source 
device B 51 of Fig. 8 can permit the contents 
transmission/reception to the sink device C 52 that is 
connected to the identical Ethernet segment A BO, and 
surely prohibit the contents transmission/reception to 
the sink device A 56 that is connected through the VPN 
server device F 53 and the sink device E 58 that 
belongs to a different Ethernet segment B 57 through 
the router device D 54- 

In this way. according to this embodiment. In the 
contents transmission/reception system in a 
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conf Iffuration shown In Fie. 8, for example, rhe source 
device B 51 can permit: the contents 

transmission/reception only to the sink device C 52 
that is connected to the Identical Ethernet segment A 
50 . and surely prohibit the contents 
transmission/reception to the sink device connected 
through the VPN server device F 53. for example. As a 
result t it is possible to prevent the Illegal contents 
rransmlsslon/receptlon. 

In the above, the configuration In which the sink 
device A 56 has the VPN client function and makes the 
connection to the Ethernet segment A 50 via the VPN 
server device F 53, but this embodiment is also 
applicable to the configuration in which the source 
device has the VPN client function. 

Fig. 9 shows a schematic configuration in the case 
where the connected states of the source device and the 
sink device are interchanged. Unlike Fig. 8, the 
contents transmission/reception system of Fig. 9 has a 
source device A 41 which has the VPN client function 
and is connected to the VPN server device F 13 via tne 
Internet 15, a sink device B 43, a sink device C 44 and 
a router device 0 45 which are connected to the 
Ethernet segment A 42, and a sink device E 47 which is 
connected to the router device D 45 through the 
Ethernet segment fi 46 . 
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Namely, the sink device B 43 and tlie sink device C 
44 Thar are connected to the VPN server device F 13 are 
existing: at locations capable ot carrying out 
communicarions with the source device A 41 via the VPN 
5 server device F 13. However, the source device A 41 and 
the sink devices B 43 and C 44 are connected to the 
different local area network, so that the 
trransinlsslon/receptlon of the contents that require the 
copyright protection should not be permitted between 
10 them. 

Here, the source device A 41 requests the MAC 
address to the sink device B 43, and acquires the MAC 
address of the sink device B 43 by the method which is 
not the IP, The source device A 41 transmits a packet 

15 (an ARP packet, for example) for inquiring the MAC 

address by usin^ the IP address of the sink device B 43 
to the Ethernet segment to which the source device A 41 
is connected. In this case, the sink device B 43 Is not 
connected to that Ethernet segment, so that the sink 

20 device B 43 will never return its own MAC address 
"BBjBBiBB" as a response. As a result, the source 
device A 41 will not acquire the MAC address of the 
sink device B 43. and the MAC address comparison 
processing will fail. Consequently, the source device A 

25 41 will carry out the error processing, and terminate 
the communication without transmitting the contents to 
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the sink device B 43. In this way, it is possible to 
prevent the conrents transmission/reception to the sink 
device B 43. and the contents distribution ranse of the 
source device A 41 can be limited within the local area 
network ot the source device A 41. 

(Second Embodiment) 

The second embodiment is directed to a 
conf ieuration in which the VPN server device and the 
VPN client device are provided between the sink device 
and the source device such that the tunnelincr between 
two networks is realized by the VPN devices . 

Fig. 10 shows a oonfi^ration of the contents 
transmission/reception system in which a VPN server 
device F 13 and a VPN client device G 49 are provided 
between a sink device A .48 and a source device B 43 
such that the tunnellnff between two networks is 
realized by the VPN server device F 13 and the VPN 
client device G 49. Flff. 11 shows the internal 
configuration of the source device and Fig. 12 shows 
the internal conf igi*ratlon of the sink device in the 
contents transmission/reception system shown In Fle- 
10, 

Unlike Fig, 1 and Fie. 8, the contents 
transmission/reception system of Fig. 10 has the VPN 
server device F 13 and the VPN client device G 49 
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provided between the sink device A 48 and the source 
device B 43, which are connecting the respective 
networks. However, the Ethernet segment A 42 to which 
The source device B 43 belongs and the Ethernet segment 
B 46 to which the slnK device A 48 belongs are 
different, so that the MAC address of the sink device a 
48 cannot be acquired by the MAC address search request 
from the source device B 43, and the comparison 
processing will fall. As a result, it Is possible to 
confirm that the sink device A 48 does not exists in 
The Ethernet segment A 42 to which the source device B 
43 belongs . 

In this way. In this second embodiment, the 
contents transmission to the sink device connected to 
the different Ethernet segment can be surely prohibited 
by permitring the contents transmission only when the 
the MAC addresses coincide as a result of the MAC 
address comfiiarlson- 

In the embodiments described above • when the sink 
device transmits its own MAC address in response to the 
request from the source device, it is also possible to 
transmit the MAC address by attaching an electronic 
signature. When the electronic signature is attached to 
the MAC address from the sink device, the source device 
carries out the verification processing to check 
whether the MAC address has been altered or not, and 
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records the MAC address into the MAC address table only 
when the MAC address has not been altered- In this way. 
The forgery of the MAC address can be surely prevented 
and the security performance can be improved, 
5 Also, the embodiments described above are directed 

to an exemplary case of carrying out the MAC address 
comparison inside the source device, but it Is also 
possible to carry out the MAC address comparison Inside 
the sink device which is the contents receiving side. 
10 For example, in the case where the roles of the sink 

device B 11 corresponding to the source device A 15 and 
the source device A 15 are interchanged in the 
configuration shown in Fig. 1. the Internal 
configuration of the source device A 15 becomes as 
15 shown in Fig- 13, and the Internal configuration of the 
sink device B 11 becomes as shown in Fig. 14, 

In this case » the contents reception from the 
source device is permitted only when the source device 
transmits its own MAC address to the sink device and 
20 the MAC addresses coincide as a result of the MAC 
address comparison inside the sink device, and the 
contents reception refusal message is transmitted to 
the source device otherwise, such that the contents 
transmission target can be limited. 
25 Fig- 15 shows three types of the VPN device 

connection state. The VPN device carries out the 
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subtraction of the TTL because It carries out the 
routine by itself- Namely, in order to carry out 
communications between the sink device and the source 
device through the VPN device as shown in Fig. 15, the 
TTL field of the IP header have to be set greater than 
or equal to an appropriate value. 

For example, la the configuration of the 
environment A shown in Fig. 15, the VPN device carries 
out the routing, so that the subtraction of the TTL 
field is carried out at each VPN device. Consequently. 
In order to carry out coimnuni cat Ions between the sink 
device A-A and the source device A-B, the TTL value 
have to be set greater than or equal to 3. Similarly, 
in the configuration of the environment B, in order to 
carry out communications between the sink device B-A 
and the source device B-B, the TTL value have to be set 
greater than or equal to 3. 

For this reason, by setting the TTL value equal to 
1, it is possible to limit the contents distribution 
through the VPN device in the environment A and the 
environment B. Here, it should be noted that the TTL 
field can be changed easily. For example, if a 
malicious user places a TTL changing device for 
Increasing the TTL field to a certain value between the 
source device and the VPN device, it would become 
possible to transmit/receive the contents beyond the 
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distribution ranse assumed by tbe source device and tJie 
sink device. 

However, by uslngr the metliod described above, even 
If the TTL changing device is placed, because the 
source device and the sink device are not physically 
belonging to the Identical se^ent, it ie still 
Impossible to learn tne MAC address of the 
correspondent by the ARP, so that the influence of the 
TTL changiner device can be avoided. 

Namely, according' to the embodiments described 
above, the existence of the VPN can be detected in a 
uniform manner re&ardless whether the environment is A, 
B or C, so that the contents distribution range can be 
limited. 

(Third Embodiment) 

In the first and second embodiments described 
above, if the same MAC address as that of the sink 
device is set to the router device or the VPN device 
that is physically connected to the identical Ethernet 
seinuent as the source device, there is a possibility of 
becomintr impossible to accurately Jud^e whether the 
source device and the sink device are physically 
connected to the identical Ethernet se^ent or not. 

For this reason, the third embodiment resolves 
such a potential problem of the first and second 
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embodiments. 

Flff. 16 shows a schematic conf Igurarlon of the 
contents transmission/ reception system according to the 
third embodiment of the present Invention, The VPN 
server device F 53 of Fl^:. IB has the same MAC address 
value "AA:AA:AA" as the slnK device A 56, unlike Fig. 
8. 

In principle, the MAC address is assigned to be 
dif:fer€nt for different physical network Interfaces by 
each manufacturing vendor. However, suppose that the 
MAC addresses happen to coincide despite of this 
principle, or a malicioas user gives The same MAC 
address values as the sink device to the VPN server 
device or the router device in order to circumvent the 
MAC address comparison check processing. 

m this case, the value of the MAC address 
obtained by the processing (ARP, for example) for 
searching the MAC address by using the IP address on 
The Ethernet by the source device B 51 is "AA:AA:AA" 
which is the MAC address of the VPN server device. As a 
result, the MAC address "AA:AA:AA" of the sink device A 
56 acquired by the upper level protocol coincides with 
the value of the MAC address obtained by ttie processing 
for searching the MAC address by using the IP address, 
so that it is impossible to Judge whether the source 
device and the sink device are physically connected to 
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the idenrical Ethernet segmenr or not. 

In the third embodiment, even If the VPN device or 
the router device that is physically connected to the 
Identical Ethernet segment as the source device has the 
5 iviAC address identical to that of the sink device, it is 
made possible to check whether the source device and 
the slnJk device are physically connected to the 
identical segn&ent or not, by checking whether the 
address resolution request has been made surely between 

10 the source device and the sink device or not. 

Fi^. 17 shows an internal configuration of the 
source device B 41 according to the third embodiment. 
The difference from the configuration of Fig, 2 is that 
it has a MAC address search advance notice processing 

15 unit 62 for transmitting a message for explicitly 

notifying that "the MAC address search request will be 
sent from now" (this message will be referred to as a 
MAC address search advance notice) before transmitting 
a message for searching the MAC address by using the IP 

20 address to the sink device, and carrying out a 

processing for checking whether a search advance notice 
response is transmitted from the sink device or not. 

Fig. 18 shows an internal configuration of the 
sink device A 56 according to the third embodiment « The 

25 difference from the configuration of Fig- 4 is that it 
has a MAC address search advance notice reception 
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processing unit 63 for receiving the MAC address search 
advance notice transmitted from the source device and 
carrying out a prescribed processlae- 

Fig. X9 shows a processing procedure in the third 
embodiment, which Is a processing procedure in the case 
where the source device and the sink device are 
physically existing in the Identical segment (the case 
where the source device B 51 and the sink device C 52 
shown in Fig, 8 carry out copunuhlcations . for example). 
Here, in order to simplify the explanation, it is 
assumed that the DTCP authentication and key exchange 
processing (step S3), the MAC address request (step S4) 
and The MAC address transmission (step S5) shown in 
Fig. 5 have been carried out » the DTCP authentication 
and key exchange has succeeded so that the source 
device has acquired the MAC address of the sink device. 

First, the source device transmits the message for 
requesting the search of the MAC address by using the 
IP address and the MAC address search advance notice to 
the sink device (steps S31 to S33) . The MAC address 
search advance notice can be transmitted by the upper 
level protocol of the Ethernet (by the IP packet, for 
example). Note that these messages may be transmitted 
simultaneously or separately. 

The sink device transmits Its own MAC address to 
the source device as a response to the MAC address 
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search request (step S34) . Also, the sink device 
records the ^act that the MAC address search request 
transmitted from the source device has received- 

The source device carries out the processing: ^or 
comparine the MAC address received as a result of the 
MAC address search request and the MAC address acquired 
m advance (step S35). Here, the MAC addresses coincide 
so that the comparison processing succeeds and the 
source device transmits the contents to the sink device 
(step S36) - 

On the other hand, the sink device carries out the 
processing for checking whether the MAC address search 
request has received or not Isrep S37) , Here, if the 
MAC address search request message from the source 
device has received, the processing will be continued 
(step S38). If the MAC address search request message 
has not received, the processing will be interrupted. 
In this case, the sink device has received the MAC 
address search request at the step S33. so that this 
checking processing succeeds and the reception of the 
contents will be started. 

Fig- 20 shows a processing procedure in the third 
embodiment in the case where the source device and the 
sink device are not physically existing in the 
identical segment (the case where the source device B 
51 and the sink device A 56 shown in Fig- 8 carry out 
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comiounl cat ions, for example). 

Similarly as in the case of Fie- 19 » first, the 
source device transmits the message for requesttne the 
search of the MAC address by uslne the IP address and 
The MAC address search advance notice to the sink 
device (steps S41 and S42) . 

The MAC address search advance notice Is 
transmitted to the sink device by the method which Is 
not the Ethernet, so that the sink device receives the 
MAC address search advance notice even if the VPN 
server exists in a middle. 

However, as far as the MAC address search request 
is concerned, the sink device Is not physically 
coxinected to the identical Ethernet segment so that the 
VPN server device makes a response as a proxy (step 
S43) and the sink device cannot receive this search 
request. 

Here, if the MAC address of the VPN server device 
and the MAC address of the sink device coincide, the 
MAC address comparison processing at the source device 
succeeds (step S44) so that the source device transmits 
the contents (step S45) despite of the fkct that the 
siiik device does not physically exists in the identical 
Ethernet segment. 

On the other hand, the sink device checks whether 
the MAC address search request message has received or 
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not (step S4B}, and when It Is ascertained that this 
request message has not received, the sink device 
interrupts the contents reception (step S47) - Then, the 
sink device may transmit a contents transmission 
interruption request message to the source device (step 
S48). such that upon receivins this message, the source 
device interrupts the contents transmission to the sink 
device (step . 

In this waXi In the third embodiment, according to 
whether the sink device has received the MAC address 
search request message or not, it is possible to check 
whether the source device and the sink device are 
physically existing in the Identical segment or not. 
even if a device that makes a response to the MAC 
address search request by forging the MAC address 
exists between the source device and the sink device, 

Note that. In the third embodiment, as long as the 
sink device can receive the MAC address search request 
from the source device. It Is not absolutely necessary 
to transmit the MAC address search advance notice from 
the source device to the sink device. However, in order 
to confirm that the MAC address search request message 
is the one transmitted from the source device, the MAC 
address or the IP address the source device or both can 
be included In the MAC address search advance notice to 
be transmitted to the sink device. In this way, when 
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the sink device receives the MAG address search 
request, ir becomes possible to Judge whether it is the 
one transmitted from the source device or not. 

Also, the sink device can comprehend tne need to 
monitor the MAC address search request upon receiving 
the MAC address search advance notice, so that there is 
no need to monitor the MAC address search request until 
the MAC address search advance notice is received, and 
the processing load of the sink device in the normal 
state can be reduced. 

(Fourth Embodiment) 

The fourth embodiment is directed to the case of 
checking whether the sink device and the source device 
are existing in the identical segment or not by a 
processing procedure different from the third 
embodiment , 

Fig. 21 shows an internal configuration of the 
source device In the fourth embodiment. The source 
device of Fig- 21 has a MAC address search advance 
notice response reception processing unit 64 for 
judging whether the MAC address search advance notice 
response from the sink device has received or noti in 
addition to the configuration of the source device 
shown in Fig- 17. 

Fig, 22 shows an internal configuration of the 



-55- 



sink device in rne fourth embodiment. Tlie sink device 
of Fie. 22 has a MAC address search advance notice 
response processing unit 65 for carrying out control to 
Transmit to the source device the MAC address search 
5 advance notice response which is a response to the MAC 
address search advance notice from the source device, 
in addition to the configuration of the sink device 
shown in Fig- 18. 

Fig- 23 shows a processing procedure in the fourth 
10 embodiment, which is a processing procedure in the case 
where the source device and the sink device are 
physically existing in the identical segment (the case 
where the source device B 51 and the sink device C 52 
shown in Fig- 8 carry out communications, for example) - 
15 Here again, in order to simplify The explanation, it is 
assumed that the DTCP authentication and key exchange 
has succeeded and the source device has acquired the 
MAC address of the sink device by another method, 
similarly as in the cases of Fig, 19 and Fig. 20. 
20 First, the source device transmits the message for 

requesting the search of the MAC address by using the 
IP address and the MAC address search advance notice to 
the sink device (steps S51 and S52), Note that these 
messages may be transmitted simultaneously or 
25 separately. 

The sink device transmits a message containing its 
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own MAC address and the search advance notice response 
to the source device ae a response to the MAC address 
search reduest (step S53) . This search advance notice 
response can be transmitted by the upper level protocol 
5 of the Ethernet (by the IP packet, tor example). Also, 
the search advance notice response message may contain 
the MAC address of the search request source or the 
search result transmission target. 

The source device receives the MAC address and the 
10 search advance notice response message as a response to 
the MAC address search request (step S54) - Note that 
the sink device may attach the signature and the 
tlmestamp in order to indicate that this message is not 
altered, and the source device may carry out the 
15 processing for verifying the signature. 

The source device carries out the processing for 
comparing the MAC address received as a result of the 
MAC address search request and the MAC address acquired 
in advance as a result of the MAC address request (step 
20 S55). Here, the MAC addresses coincide so that the 
comparison processing succeeds. 

Also, the source device carries out the processing 
for checking whether the search advance notice response 
has received or not (step S58) . In this checking 
25 processing. If the search advance notice response 
message from the sink device has received, the 
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processing will be continued, whereas if it: has not 
received, the processing will be interrupted. Here, the 
MAC address search advance notice response has received 
at the step S54, so that this checking processing 
succeeds and the transmission of the contents will be 
started (step S57) . 

Note that, in the case where the timestamp is 
contained in the search advance notice response 
message » it is also possible to check that the value Tl 
of the timestamp Is after the time TO at which the MAC 
address search advance notice was sent by the source 
device and before the time T2 at which the MAC address 
was received. 

Fig. 24 shows a processing procedure in the fourth 
embodiment in the case where the source device and the 
sink device are not physically existing in the 
Identical segment (the case where the source device B 
51 and the sink device A 56 shown In Fig. 8 carry out 
communications, for example). 

First, the source device transmits the MAC address 
search request and the MAC address search advance 
notice to the sink device (steps S61 and S62) . The MAC 
address search advance notice is transmitted by the 
upper level protocol of the Ethernet, so that the slnK 
device receives the MAC address search advance notice. 
However, as far as the MAC address search request is 
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concerned, the sink device is not physically connecred 
xo the identical Ethernet segment so that the VPN 
server device makes a response as a proxy (step S63) 
and the sink device cannot receive this search request . 
For this reason, the sink device will never transmit 
the MAC address search response and the MAC address 
search advance notice response to the source device. 

On the other hand, the source device receives the 
MAC address from the VPN server device. Here, it the 
MAC address of the VPN server device and the MAC 
address of the sink device coincide, the MAC address 
comparison processing: at the source device succeeds 
(step S64) . However, the search advance notice response 
has not received, so that the checking processine falls 
(step S65), and the source device interrupts the 
contents transmission (step 568}. 

What requires attention here is that the message 
for requesting the search of the MAC address hy using 
the IP address is transmitted not only by the source 
device but also by the general router device or the 
like. For this reason the sink device cannot ascertain 
the MAC address search advance notice response for 
responding to which requesi; message should be 
transmitted to the source device. Consequently, by 
transmitting the IP address or the MAC address of the 
source device or both by the MAC address search advance 
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norlce. It becomes possible tor the sink device to 
Judee that the MAC address search advance notice 
response for responding to the request message 
transmitted from a specific IP address or MAC address 
should be transmitted. 

In this way, In the fourth embodiment, the MAC 
address search advance notice Is transmitted from the 
source device to the sink device by the method which Is 
not the Ethernet, so that even if the router device or 
the VPN device that has the same MAC address as the 
sink device exists between the source device and the 
sink device, it is possibly for the sink device to 
accurately Judge whether it is connected to the 
identical segment as the source device or not according 
to whether a response to this notice has received, and 
therefore It Is possible to realize the copyright 
protection for the contents. 

Also, this MAC address search advance notice and 
its response are used for the purpose of the copyright 
protection of the contents, and the placing of a device 
for transmitting a forged response to the MAC address 
search advance notice In order to cause an error in the 
judgement can be regarded as an Intentional placing for 
the purpose of evading the copyright protection of the 
contents. 

Note that, in the above, it has been assiuned that 
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The MAC address search advance notice and the MAC 
address search advance notice response use the upper 
level protocol of the Ethernet, but they may be defined 
as one of a ^roup of conimands defined by the DTCP. In 
5 this case, the MAC address search advance notice and 
the MAC address search advance notice response can be 
made as parts of the DTCP authentication and key 
exchan&e processing, so that it is possible to simplify 
the device configurations. 

10 

(Fifth Embodiment) 

The fourth embodiment described above is directed 
to the configuration in which the source device 
transmits the MAC address search advance notice to the 

15 sink device and the sink device transmits the MAC 

address search advance notice response to the source 
device. In contrast, the fifth embodiment is directed 
to the configuration in which the sink device transmits 
the MAC address search advance notice to the source 

20 device and the source device transmits the MAC address 
search advance notice response to the sink device. 

Fig. 25 shows an Internal conf iffuration of the 
source device in the fifth embodiment. The source 
device of Fig. 25 has a configuration in which the MAC 

25 address recording unit 24. the MAC address search 
processing unit 25 and the MAC address comparison 
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processing unit 28 are omitted from the source device 
of Fiff- 17 while the MAC address search advance notice 
reception processlne unit 63, the VPN c]tent unit 34 
and the MAC address transmission unit 33 similar to 
those ot the sink device of Fig. 18 are added. 

Fig. 26 shows an Internal configuration of the 
sink device in the fifth embodiment. The sink device of 
Fiff- 26 has a configuration in which the MAC address 
search advance notice reception processing unit 63. the 
VPN client unit 34 and the MAC address transmission 
unit 33 are omitted from the sink device of Fig- 1« 
while the MAC address recording unit 24, the MAC 
address search processing unit 25. the MAC address 
comparison processing unit 26, and the MAC address 
searcn advance notice processing unit 62 similar to 
those of the source device of Fig. 17 are added. 

Fig. 27 shows a processing procedure in the fifth 
embodiment in the ease where the source device and the 
sink device are physically existing in the identical 
segment. Note that, as a prerequisite for starting the 
processing of Fig- 27. it is assumed that the DTCP 
authentication and key exchange has carried out between 
rhe sink device and the source device and the sink 
device has acquired the MAC address of the source 
device in advance. 

First, the sink device transmits the MAC address 
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search request and the MAC address search advance 
notice to the source device (step S71). and carries out 
the MAC address search by nsinff the IP address of the 
source device (step S72) . 

Upon receivlne the MAC address search request from 
the sink device (step S73} . the source device transmits 
Its own MAC address to the sink device (step S74). 

The sink device carries out the processing for 
comparing the MAC address transmitted from the source 
device and the MAC address of the source device 
acquired in advance to see whether they coincide or not 
(step S75). and if they coincide, the sink device 
receives the contents from the source device (step 
S76) . 

The source device carries out the processing for 
checking: whether the MAC address search request from 
the sink device has received or not (step S77} . if it 
has received, the source device continues the contents 
reception (step S78), whereas if it has not received, a 
prescribed error processing is carried out and the 
contents reception is interrupted. 

Fig, 28 shows a processing procedure in the fifth 
embodiment in the case where the source device and the 
sink device are not physically existing in the 
identical segment. In this case, the source device is 
not physically connected to the identical segment as 
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The sink device, the MAC address search advance notice 
transmitted by the method which is not the Ethernet 
from the sink device reaches to the source device {step 
S81), but even If the search of the MAC address by 
5 using the IP address of the source address is attempted 
(step S82), the VPN server device makes a response as a 
proxy (step S83) , 

If the MAC address of the VPN server device and 
the MAC address of the source device are Identical, the 
10 MAC address comparison processing at the sink device 
succeeds (step S84>, and the source device transmits 
the contents to the sink device (step S85) . 

However, the source device has not received the 
MAC address search request (step S86). so that the 
15 contents transmission is interrupted (step S87J . 

In this way. in the fifth embodiment, tne contents 
transmission can be Interrupted surely as long as the 
source device is not connected to the identical 
segment, even if the MAC address of the VPN server 
20 device that is connected to the identical segment as 
the sink device is identical to the MAC address of the 
source device. 

(Sixth Embodiment) 
25 The sixth embodiment is directed to the case in 

which, upon receiving the MAC address search advance 
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noclce from the sink device, the source device 
transmire a response to it to the sink device . In the 
configuration of the fifth emhodlment . 

Fig. 29 shows an internal conf isuratlon of the 
source device in the sixth embodiment. Tne source 
device of Flff. 29 has the MAC address search advance 
notice response proceesinc anit 65 for carrying out 
control to transmit the MAC address search advance 
notice response to the sink device, in addition to the 
conf iffuratlon of the source device of Fig. 25. 

FLs. 30 shows an internal configuration of the 
sink device in the sixth embodiment. The sink device of 
Fig. 30 has the MAC address search advance notice 
response reception processing unit B4 for carrying out 
control to receive the MAC address search advance 
notice response from the source address, in addition to 
the configuration of the sink device of Fig. 26. 

Fig. 31 shows a processing procedure in the sixth 
embodiment in the case where the source device and the 
sink device are physically existing in the identical 
segment. Note that, as a prerequisite for starting the 
processing of Fig. 31, it is assumed that the DTCP 
authentication and key exchange has carried out between 
the sink device and the source device and the sink 
device has acquired the MAC address of the source 
device in advance. In the following, the difference 
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from the case of Flff. 27 will be mainly described. 

When the source device receives The MAC address 
search advance notice from the sink device (step S91) , 
The source device transmits a response to It (the MAC 
address search advance notice response) to the sink 
device (step S93J - 

The sink device receives the MAC address search 
advance notice response from the source device {step 
S95) . and carries out the MAC address comparison 
processing (step S96 ) . Then, the sink device Judges 
whether the MAC address search advance notice response 
has received or not (step S97>. and If it has received, 
the sink device receives the contents transmitted from 
the source device (step S98). 

Pis. 32 shows a processing procedure In the sixth 
embodiment in the case where the source device and the 
sink device are not physically existinir in the 
identical segment. The sink device transmits the MAC 
address search advance notice by using the method which 
is not the Ethernet to the source device (step SlOl), 
so that the source device can receive this notice, but 
when the MAC address search by usins the IP address of 
the source address Is carried out: by the sink device 
(step S102). the VPN server device tnat is located in 
the identical eegrment as the sink device makes a 
response indicating the MAC address as a proxy (step 
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S103). 

If the MAC address of The VPN server device and 
the MAC address of the source device are Identical, the 
MAC address comparison processing at the sink device 
succeeds (step S104) , but the sink device has not 
received the MAC address search advance notice response 
fro the source device (step S105) so that the sink 
device requests the interruption of the contents 
transmission to rhe source device (step S106) and the 
source device interrupts the contents transmission 
Cstep S107). 

In this way, in the sixth embodiment, the contents 
transmission is carried out only when the response to 
the MAC address search advance notice transmitted from 
the sink device to the source device is received by the 
sink device, so that it is possible to carry out the 
contents transmission only in the case where the sink 
device and the source device are located in the 
identical segment. 

As described above, according to t:he present 
invention, the transmission of the contents to the 
corresponding reception device is permitted only in the 
case where the device identification Information 
searched out by the device identification information 
searching unit and the device identification 
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InformaTlon registered by rhe device Idenrif icarlon 
information reslstration unit coincide, so tHat it is 
possible to provide the contents only to the limited 
reception devices, and it is possible to prevent the 
5 illegal reception ot the contents. 

In this way, it Is possible to change the contents 
distribution conditions by dlstlngrulshlng the reception 
device physically connected to the identical sub-net 
and the reception devices virtually connected to the 
10 identical sub-net among a plurality ot reception 
devices of the same sub-net. 

Also, according to the present invention, by 
checking whether the device identification information 
search request from the transmission device has 
15 received by the reception device or not. it is possible 
to Judge whether the transmission device and the 
reception device are connected to the Identical segment 
or not easily and accurately. 

It is also to be noted that* besides those already 
20 mentioned above, many modifications and variations of 
the above embodiments may be made without departing 
from the novel and advantageous features of the present 
Invention. Accordingly, all such modifications and 
variations are Intended to be Included within the scope 
25 of the appended claims. 
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